tune.ssl.default-dh-param 2048
ssl-server-verify none

stats socket /var/lib/haproxy/stats

defaults
  mode                    http
  log                     global
  option                  httplog
  option                  dontlognull
  option http-server-close
  option forwardfor       except 127.0.0.0/8
  option                  redispatch
  retries                 3
  timeout http-request    10s
  timeout queue           1m
  timeout connect         10s
  timeout client          1m
  timeout server          1m
  timeout http-keep-alive 10s
  timeout check           10s
  maxconn                 3000

frontend http-in
bind 192.168.0.89:80
rspadd X-Forwarded-Host: http:\potpis.corp
redirect scheme https code 301 if !{ ssl_fc }

frontend https-in
mode tcp
bind 192.168.97.0:443 ssl crt /etc/ssl/certs/potpis.cer ca-file /etc/ssl/certs/hr_sca.pem verify required
rspadd X-Forwarded-Host: https:\potpis.corp
rspadd Strict-Transport-Security: max-age=31536000

default_backend moodle

backend moodle
    mode tcp
    server backend server1.1.1.1:443 ssl